Sign, verify, and HMAC operations

KMS supports asymmetric signing and verification for RSA, ECDSA, and Ed25519 keys, and HMAC generation and verification for HMAC key types.

Sign and verify

Supported key types

API operations

Sign

Submit the data to sign as base64-encoded input. The response includes the signature and the key version used.

INPUT=$(echo -n "document content" | base64)

curl -s -X POST \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Organisation-Identity: $ORG_ID" \
  -H "Content-Type: application/json" \
  -d "{\"input\": \"$INPUT\"}" \
  https://api.thalassa.cloud/v1/kms/nl-01/keys/my-signing-key/sign

Verify

Submit the original input and signature. The response indicates whether the signature is valid.

curl -s -X POST \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Organisation-Identity: $ORG_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "input": "'"$INPUT"'",
    "signature": "'"$SIGNATURE"'"
  }' \
  https://api.thalassa.cloud/v1/kms/nl-01/keys/my-signing-key/verify

Use cases

• DNS DNSSEC — Zone signing uses a regional asymmetric KMS key as the Key Signing Key (KSK). See Integrations and DNSSEC.
• Code and artifact signing — Sign release artifacts, configuration bundles, or attestations
• Document signing — Verify signed documents using exported public keys for offline validation

New sign operations use the latest key version by default. Signatures embed version information so verification works across rotations.

HMAC

Supported key types

HMAC keys cannot be imported via BYOK.

API operations

Generate HMAC

INPUT=$(echo -n "webhook-payload" | base64)

curl -s -X POST \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Organisation-Identity: $ORG_ID" \
  -H "Content-Type: application/json" \
  -d "{\"input\": \"$INPUT\"}" \
  https://api.thalassa.cloud/v1/kms/nl-01/keys/api-hmac/hmac

Verify HMAC

curl -s -X POST \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Organisation-Identity: $ORG_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "input": "'"$INPUT"'",
    "hmac": "'"$HMAC"'"
  }' \
  https://api.thalassa.cloud/v1/kms/nl-01/keys/api-hmac/verify-hmac

Use cases

• Webhook payload authentication
• API request integrity checks
• Token or session validation where symmetric message authentication is appropriate

Public key export for offline verification

For RSA and ECDSA keys, export public keys in PEM format. For Ed25519, public keys are returned as base64-encoded raw key material.

GET /v1/kms/{region}/keys/{id}/public-key

Use exported public keys to verify signatures without calling the verify API, or for client-side RSA encryption workflows. See Export and public keys.

Regional requirement

All sign, verify, HMAC, and verify-HMAC calls must target the key’s region. Cross-region use is not supported.

Errors

Audit events

See Audit log for what is and is not recorded.